Users Guide

common-name value does not match the device’s presented identity, a signed certificate does not
validate.
● email email-address — Enter a valid email address used to communicate with the organization.
● validity days — Enter the number of days that the certificate is valid. For a CSR, validity has no
effect. For a self-signed certificate, the default is 3650 days or 10 years.
● length bit-length — Enter a bit value for the keyword length. For FIPS mode, the range is from
2048 to 4096; for non-FIPS mode, the range is from 1024 to 4096. The default key length for both
FIPS and non-FIPS mode is 2048 bits. The minimum key length value for FIPS mode is 2048 bits. The
minimum key length value for non-FIPS mode is 1024 bits.
● altname altname — Enter an alternate name for the organization; for example, using the IP
address such as altname IP:192.168.1.100.
Default Not configured
Command mode EXEC
Usage
information
Generate a CSR when you want a CA to sign a host certificate. Generate a self-signed certificate if you
do not set up a CA and implement a certificate trust model in your network.
If you enter the cert-file option, you must enter all the required parameters, including the local path
where the certificate and private key are stored.
If you do not specify the cert-file option, you are prompted to fill in the other parameter values for
the certificate interactively; for example:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value; if you enter '.', the
field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) []:Starfleet Command
Organizational Unit Name (eg, section) []:NCC-1701A
Common Name (eg, YOUR name) [hostname]:S4148-001
Email Address []:[e-mail]
If the system is in FIPS mode — crypto fips enable command — the CSR and private key are
generated using approved algorithms from a cryptographic library that has been validated against the
FIPS 140-2 standard. You can install the FIPS-compliant certificate-key pair using the crypto cert
install command with the fips option.
Examples
OS10# crypto cert generate request cert-file home://cert1.pem key-file
home://cee OS10-VM email [e-mail] length 1024 altname DNS.dell.com
Processing certificate ...
Successfully created CSR file /home/admin/cert1.pem and key
OS10# crypto cert generate self-signed cert-file home://cert2.pem key-
file home:e OS10-VM email [e-mail] length 1024 altname.dell.com
validity 365
Processing certificate ...
Successfully created certificate file /home/admin/cert2.pem and key
Supported
releases
10.4.3.0 or later
1182 Security